With the rapid developments in aircraft technology, ever-increasing flight envelopes, and overall performance, the flight control systems implemented in modern aircraft have become extremely complex. Advanced flight control systems have therefore been developed to address various aircraft characteristics such as flight performance, fuel efficiency, safety, etc. A primary flight control system on a modern aircraft typically includes a complex set of components including pilot controls, aircraft sensors, electronic processor, electronic wiring or data buses, actuators, and control surfaces. Unfortunately, as the primary flight control system increases in complexity, the aircraft may be increasingly vulnerable to a system fault or processor failure.
In accordance with flight regulations and in the interest of developing robust aircraft, modern aircraft include secondary or redundant elements or systems for use in the event that the primary control system fails or experiences system faults. Despite a low probability of failure of processor based control systems, flight control systems often fail to address the problem of a generic fault in the transmission media or in the command processing of the primary flight control system. Although redundant elements of the primary control system may be included as a safety measure, a generic fault occurring in the primary processing or transmission media could disable not only the primary control system but also any redundant elements and, in some cases propagate to separate backup system. Control systems, such as the flight control system disclosed in U.S. Pat. No. 6,860,452, have employed centralized primary and fully redundant backup systems that include dissimilarity between groups of primary and redundant channels in an attempt to address this concern. However, such an approach requires extremely careful analysis and design efforts to insure that the dissimilarity truly applies throughout the entire complex electronics device path needed for the primary flight control.
While a primary flight control system may be typically capable of verifying the integrity of the system through, for example, redundant sensors and two-way digital data buses, a backup flight control system may lack sufficient means to monitor itself or assure proper functioning when unused. For example, during normal flight operation at a steady altitude, attitude, heading, and airspeed, the control signals from a primary and backup system may remain constant over long periods of time. Although the signals from the primary and backup systems may properly correspond under these conditions, it is possible that the backup system may have experienced a fault or be frozen, outputting a temporary correct signal. Consequently, the backup system may be unavailable or disabled despite appearing to function properly, providing pilots and operators a false sense of security.
In a distributed control system, the actuator control loop closure of a control surface actuator is executed at or near the actuator itself and the aircraft level control laws are executed on computing platforms commonly known as the flight control computers (“FCC”), generally located at or near the aircraft cockpit. The introduction of smart actuators, which may include some processing capability, has added the ability to perform certain processor functions at the actuator. A smart actuator, as defined herein, may include a mechanical actuation device, such as hydraulic cylinder and its associated control valves or an electromechanical actuation device, and a remote electronics unit (“REU”). The remote electronics unit may be an integral part of the actuator, a line-replaceable unit (“LRU”) mounted on the actuator, or a unit mounted near the actuator. A remote electronics unit, associated with one of the control surfaces on an aircraft, may operate by receiving a control surface position command from a flight control computer (FCC) and then generating a specific signal to the actuator. If the actuator includes a feedback sensor and feedback signal, the remote electronics unit may perform feedback control of the control surface position without relying on the FCC. The FCC may be located, for example, in the avionics bays, typically near the cockpit. By using a REU, a flight control system may reduce the amount of processing needed in the flight control computers.
Distributed control system may also permit the use of different types of data transmission media. Data buses may be used with the smart actuators to monitor the control system, allowing the remote electronics unit of the smart actuator to insure the integrity of the control signal (end-to-end) and monitor a data bus for actuator specific commands. Further, the smart actuators may enable the use of data bus transmission media (such as ARINC429 or CAN bus or their derivatives), significantly reducing the number and weight of the transmission wiring over traditional flight control systems. In some smart actuator control systems, a single two wire bus may be used to connect all of the smart actuators to the processors or control computers. In other, more conservative, smart actuation control systems, multiple dedicated point-to-point data buses may be used to connect the centralized flight control computer or equivalent to each individual smart actuator. There may also be more than one primary point-to-point data bus between the flight control computers and a given smart actuator according to varying levels of redundancy.